CVE-2021-22040: VMware Cloud Foundation

Medium severity, CVSS 6.7. EPSS: 0.7% chance of exploitation in the next 30 days.

VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

Affected products

• VMware Cloud Foundation: from 3.0, before 3.11 (fixed in 3.11); from 4.0, before 4.4 (fixed in 4.4)
• VMware ESXi: version 6.5 only; version 6.7 only; version 7.0 only
• VMware Fusion: from 12.0.0, before 12.2.1 (fixed in 12.2.1)
• VMware Workstation Player: from 16.0.0, before 16.2.1 (fixed in 16.2.1)
• VMware Workstation Pro: from 16.0.0, before 16.2.1 (fixed in 16.2.1)

Published 2022-02-16. Last modified 2026-06-17.